Executive Summary
A paramount concern in elections is how to regularly ensure that
the vote count is accurate. Most voting systems
commonly offer "assurances" of accuracy, and ask for our
"trust." But this evades
the issue: Vote counts will remain controversial as long as
"proof" is absent. Is there a way to
obtain proof for each election? Yes,
there is a way—perhaps the only way: Publish the ballots openly. This will permit every citizen to check
the accuracy of the count. We call this the
"Citizens Audit." Ideally,
it includes the following: 1. A computer previews
the voter's ballot, so that the voter can correct any errors. 2. The computer prints
a human-readable, flawless ballot, which the voter then verifies. 3. After all ballots
are cast, they are videotaped by private citizens, and then are published. 4. Election officials
tally the votes as usual, from the original ballots; the community tallies Convenience. A
"Citizens Audit" is unobtrusive.
It need not place demands on the attention of poll officials, and it need not disrupt,
delay, or otherwise impede the election process. Cost. Given
today's technology, the cost of a "Citizens Audit" can be
negligible. Cornerstone On page eight of Myth Breakers: Facts about
Electronic Elections, author Ellen Thiesen affirms the importance of
transparency in elections: Election transparency is the fundamental basis of election integrity. In transparent elections, all the processes of handling and counting
ballots are completely open to public view. Nothing is hidden, nothing is
secret--except, of course, each individual's voting choices. Election fraud and miscounts have occurred throughout history, and
they will continue to occur. Transparency is the only way to minimize
them.... But in virtually all discussions
of election transparency, one line of thinking has remained taboo: The
idea that even the ballots themselves could be made "transparent." After all, wouldn't that violate the
principle of the "secret ballot"? But there's one thing puzzling about that
principle: What, precisely, is being kept secret? ·
It's not the
ballot. During handcounts, the ballot commonly gets read aloud in
public. ·
It's not the voters.
After all, voters publicly announce their names in the polling place. Yet we still feel
that the principle of the "secret ballot" is being honored.
Why is this? The reason is this: The true
meaning and intent of the "secret ballot" is not to keep the
ballot a secret, nor to keep the voter a secret. It's to keep secret which
voter cast which ballot. What's intended to be kept secret is
precisely the authorship of the ballot, not its contents. A more apt name for this policy is, the
"anonymous ballot." Once we grasp this
distinction, a new vista opens, one in which we are freed to conceive voting
systems that are fully transparent and verifiable: Systems in which
not merely the vote totals, but the very ballots themselves, become an open
and integral part of the public record. Outline of the Process
1. A computer helps the voter compose a
defect-free ballot. (Optional.) 2. The computer prints the paper ballot. (Optional, though required by step one.) 3. The voter verifies the paper ballot. 4. The voter deposits the ballot into the
ballot box. 5. During the vote count, interested citizens
make photographic copies of the ballot. 6. The copies are made available to the
general public. Details of the Process
1. A computer helps the voter compose a defect-free
ballot. (Optional.) The voter's intent in any
given contest may be undecipherable if the voter makes an error in marking
the ballot. Common errors include-- ·
Overvoting (casting
too many votes in a particular contest). ·
Undervoting
(unintentionally failing to cast a vote in a particular contest). ·
Marking the ballot
ambiguously ("Is it an underline or a crossout?"). ·
Entering a write-in
candidate illegibly. ·
Marking the wrong
box, and then deciding not to correct the mistake. Such errors are avoided if
the voter is assisted by a touch-screen voting machine. For instance,
unintentional undervotes can be avoided if each contest offers a box with the
caption, "None of the above."
The computer can then require that each contest have at least one box
marked. Note: Computer
voting machines, like all devices, are prone to malfunction. If this occurs during voting hours, voters
may be denied the opportunity to vote.
For this reason, each polling place must offer voters the option to
mark their ballot manually. 2. The computer prints the paper ballot. (Optional, though required by step one.) Computer records are
inherently alterable. If they
weren't, computers would be useless. But this alterability
means that votes which reside inside a computer are not secure from
alteration. There is always a chance
that the internal computer copy of a voter's choices may deviate from the
voter's intent. Deviations can result
from a hardware glitch, a software bug, intentional tampering, operator
error, electrical interruptions, or other causes. Encryption schemes are
sometimes claimed to hold promise for preventing alteration of the
ballot. But, even apart from the
above problems, encryption schemes are fallible. ·
In order to be
usable, the ballot has to be unencrypted at certain times. During those times, it is vulnerable to
alteration. ·
The encryption
software itself may be defective. For
instance, a security hole was open for more than two-and-a-half years in the
"VPN" encryption module in Windows 2000 and Windows XP. http://www.extremetech.com/article2/0,1558,587234,00.asp A paper ballot (whether
computer generated or hand marked) is immune to such problems. 3. The voter verifies
the paper ballot. As discussed above, the
computer copy of the voter's choices can differ from those on the paper
ballot. To remove all doubt about the
accuracy of the paper ballot, the voter must be permitted to verify the
actual ballot, not merely verify the on-screen copy of the ballot. Since it is the paper document that is the legal bearer of the voter's
choices, any hidden problems in the voting machine become irrelevant. Once in hand and confirmed by the voter,
the paper ballot is outside the control of the computer. The voter is thereby
freed of concern about the political leanings of the computer manufacturer,
about the competence of the software engineers, and about the chances that
the votes will be lost or altered by computer tampering. The threat—and incentive—for machine
tampering is neutralized. The paper ballot can
provide equal assurance to handicapped voters, since it can be read back
audibly to the voter by a suitable device.
Once again, to eliminate concerns about computer accuracy, it should
be the actual paper ballot, and not the computer's internal record of the
ballot, that is read back to the voter. 4. The voter deposits
the paper ballot into the ballot box. ·
If the depositing or discarding
of the paper ballot is controlled by the computer, and is not done in public
view, voters may question whether the ballot was routed correctly. ·
If the computer can
both create and deposit a ballot, a malfunction may result in the computer's
creating and depositing unauthorized additional ballots. ·
Requiring the voter
to publicly deposit the ballot prevents the voter from creating and
depositing more than one ballot without being observed. ·
The voter will not
mistakenly remove the ballot from the polling place if the ballot is a
familiar, full-size placard (instead of a "receipt"), and if the
ballot box is prominent. 5. During the vote
count, interested citizens make photographic copies of the ballot. There is always a concern
that the official set of completed ballots may become adulterated. This concern can be allayed by creating
certifiable backup copies of the ballots. This can be easily done by
videotaping the entire set of ballots. a. The video copying should be unobtrusive and
not interfere with the counting process. b. The video copies should be created while the
ballots are being counted. (Optional.) This will ensure
that there is a one-to-one match between the ballot originals and the ballot
copies. ·
If the votes are
being counted by hand, the judges can count the votes on each ballot while it
is on display. This allows adequate
time for videotaping the ballots. ·
If the ballots are
being tabulated by optical scanner, each ballot can be placed on display for
a few seconds after being optically scanned.
Again, this offers sufficient time for videotaping. ·
If the ballots are
being counted by "photoscan," the display considerations are the
same as those for optical scanning, above. "Photoscan" refers to taking a snapshot of the displayed ballot with a digital
camera. When all the ballots have
been photographed, their images are downloaded into a handheld or laptop
computer, which tallies the votes by analyzing the ballot images. Each poll watcher can bring their own photoscan equipment and can
generate a separate, personal audit of the vote count—possibly at the polling
place itself. (Estimated cost of such equipment is $600 - $750 at June 2005
prices. A working prototype has been
built using a $50 digital camera, a notebook computer, OCR software that came
free with a flatbed scanner, and additional free software.) In each case
above, the display of the ballots is seamlessly integrated into the counting
process, and does not delay, impede, or interrupt the proceedings. But
suppose a jurisdiction does not tally the vote by using the paper
ballots? In that case, displaying the
paper ballots for videotaping becomes a separate and distinct process, and
the time it consumes does become a factor. Nevertheless,
if it takes only seven seconds to
handle and display a ballot, and if five hundred ballots were cast in the
precinct, then the time consumed in videotaping will be less than one
hour. And the delay becomes
effectively even less if the videotaping is done in parallel with other
wrap-up tasks in the polling place. c. Each
copy should incorporate inherent proof of its own completeness and accuracy. This
is accomplished if each videotape captures, from start to finish, without
pause, the entire process of displaying the ballots. d. The news media and the general public must be
permitted to make such copies.
6. The copies are made available to the
general public. a. Publishing the ballots
allows every citizen to verify the vote count. The election
jurisdiction or the news media can publish each precinct's ballots on the
Internet in text, graphic, or even video format. This can be done at little or no expense. Citizens
are allowed to double-check those copies against the original videotapes, so
that those copies can be used confidently to confirm or to contest the
official vote count. b. Publishing the
ballots will not compromise the secrecy of the ballot. To
reiterate, the "secret ballot" is not intended to hide the identity
of voters, nor to hide the contents of their ballots. The
"secret ballot" aims at concealing only one specific datum:
"who cast which ballot." That information
is not compromised by reading each ballot aloud in the polling place, even
though observers may be audiotaping the proceedings. Likewise, that information is not
compromised by viewing each ballot openly in a public arena. (This all assumes that the ballots
received a proper shuffling upon removal from the ballot box.) c. Publishing the ballots makes possible highly
detailed research into voting patterns and possible election irregularities. By publishing
images of the ballots, we make "every vote count" not only during
the election, but also during later research into voting patterns. Researchers no longer need to rely on
polls, sampling, and guesswork in order to assess voter intent and behavor. One
special benefit is that fully detailed studies can help reveal suspicious
vote patterns, ones that may indicate large-scale malfunctions or tampering,
unnoticeable on the local level. This
would help us discover and remedy—and perhaps deter—such problems. An excellent
return for such a modest investment. [end] |
